VB 3.8.7 is the only 3.x version without known exploits. Anyone running 3.x should have upgraded by now... Or, as in the case of this site, be able to code fixes themselves.
I'm not sure if the yahoo yui script is to blame, but you should most definitely be using a remote YUI site- you can set this in Admin CP - Settings -> Options -> Server Settings and Optimization Options
|